Verification of Parameterised FPGA Circuit Descriptions with Layout ...

CHAPTER 4. VERIFYING CIRCUIT LAYOUTS 87
is handled by checking the statements against themselves with a new identifier substituted
for the loop variable. Intersection is only permitted if the two loop variables are the same and
thus describing one iteration of the loop, which will obviously intersect totally with itself.
The intersection theorem generated for map illustrates this, containing only the case checking
that loop iterations do not overlap:
theorem "Î(n::int) (R::((’t395⇒ ’t396⇒ bool,’t395⇒ ’t396⇒ int)block)) (i::(’t395)vector) (o
::(’t396)vector). ∀ (j::int). ((0 ≤ j) ∧ (j ≤ (n − 1))) −→ Def (i ;;; R ;;; o ) ; ∀ (
qs691::’t395) (qs692::’t396). 0 ≤ (Height (qs691 ;;; R ;;; qs692)) ; ∀ (qs691 ::’ t395) (qs692
::’ t396). 0 ≤ (Width (qs691 ;;; R ;;; qs692)) =⇒
∀ (j :: int) (j ’:: int). ((0 ≤ j) ∧ (j ≤ (n − 1)) ∧ (0 ≤ j’) ∧ (j’ ≤ (n − 1)) ∧ (j’ = j)) −→
(((0 + (Width (i ;;; R ;;; o ))) ≤ 0) | ((0 + (Width (i ;;; R ;;; o ))) ≤
0) | ((sum (0, j’ − 1, λ qs403. Height (i ;;; R ;;; o )) + (Height (i ;;; R ;;; o ))) ≤ sum (0, j − 1, λqs403. Height (i ;;; R ;;; o )))
| ((sum (0, j − 1, λqs403. Height (i ;;; R ;;; o )) + (Height (i ;;;
R ;;; o ))) ≤ sum (0, j’ − 1, λqs403. Height (i ;;; R ;;; o ))))"
It is important to note that the algorithms given in Figure 4.10 and Figure 4.11 are pseudo-
code and the implementation in the Quartz compiler differs slightly. For example, the com-
piler carries out a large number of optimisations to eliminate unnecessary goals that are
defined as being true. In addition, rather than generating one large intersection theorem
the compiler splits it on a statement by statement basis into multiple theorems to make the
individual proofs a little simpler.
While containment and intersection theorems are not used elsewhere, the validity theorems
often are. It is therefore often useful to “prune” the assumption sets of these theorems to
remove assumptions that are not necessary for the proof. When these theorems are used in
other proofs the assumptions will themselves become proof goals and proofs can be simplified
if the number of assumptions is minimised.